İCO. 


Information Commissioner's Office 


ICO call for views on a direct marketing code 
of practice 


The Information Commissioner is calling for views on a direct 
marketing code of practice. 


The Data Protection Act 2018 requires the Commissioner to produce 
a code of practice that provides practical guidance and promotes 
good practice in regard to direct marketing. 


While direct marketing is an important and useful tool to help 
organisations engage with people in order to grow their business or 
to publicise and gain support for their causes, it can also be 
intrusive and have a negative impact on people if done badly. This 
can cause reputational damage to organisations and, in some cases, 
result in fines or other regulatory action for breaking data protection 
laws. 


So it is important that organisations ensure their marketing 
activities are compliant with data protection legislation (the General 
Data Protection Regulation and Data Protection Act 2018) and, 
where necessary, the Privacy and Electronic Communications 
Regulations 2003 (PECR). 


We have previously published detailed direct marketing guidance. 
The new code will build on that guidance and address the aspects of 
the new legislation relevant to direct marketing such as 
transparency and lawful bases for processing, as well as covering 
the rules on electronic marketing (for example emails, text 
messages, phone calls) under PECR. 


The European Union is in the process of replacing the current e- 
privacy law (and therefore PECR) with a new ePrivacy Regulation 
(ePR). However the new ePR is yet to be agreed and there is no 
certainty about what the final rules will be. Because of this we 
intend for the direct marketing code to only cover the current PECR 
rules until the ePR is agreed. Once the ePR is finalised and the UK 
position in relation to it is clear we will produce an updated version 
of the code which takes this into account as appropriate. 


This call for views is the first stage of the consultation process. The 
Commissioner is seeking input from relevant stakeholders, including 
trade associations, data subjects and those representing the 
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interests of data subjects. We will use the responses we receive to 
inform our work in developing the code. 


You can email your response to directmarketingcode@ico.org.uk 
Or print and post to: 


Direct Marketing Code Call for Views 
Engagement Department 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the call for views, please 
email the Direct Marketing Code team. 


Please send us your views by 24 December 2018. 


Privacy statement 


For this call for views we will publish responses received from 
organisations but will remove any personal data before publication. 
We will not publish responses from individuals. For more 
information about what we do with personal data please see our 


privacy notice. 
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uestions 


Q1 The code will address the changes in data protection 
legislation and the implications for direct marketing. What 
changes to the data protection legislation do you think we 
should focus on in the direct marketing code? 


Further examples of direct marketing, to make it easier to 
differentiate from actions taken in the course of conducting 
business that isn't marketing. 

The changes to obtaining consent and withdrawing consent. 
How the GDPR rights affect direct marketing. 

How the changes address business to business marketing to 
individuals at corporate addresses and numbers, howsoever 
made, the contact being in respect of their employment, rather 
than their personal life. 


Q2 Apart from the recent changes to data protection legislation 
are there other developments that are having an impact on 
your organisation's direct marketing practices that you think 
we should address in the code? 

x 
Yes 


[ ] No 


Q3 If yes please specify 


Technology and uses of personal data are developing at a fast 
rate. In so far as possible the principles need to be very defined 
so developers and businesses are able to apply the Code to 
technologies and uses of data that cannot reasonably be in the 
ICO’s scope when drafting the code. 
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Q4 


Q5 


We are planning to produce the code before the draft ePrivacy 
Regulation (ePR) is agreed. We will then produce a revised 
code once the ePR becomes law. Do you agree with this 
approach? 


x Yes 


[ ] No 


® 
If no please explain why you disagree 1CO. 


Information Canimlssioners Office 


Yes agree with this approach, given the uncertainty of timing of 
implementation of ePR. 


Q6 Is the content of the ICO’s existing direct marketing guidance 
relevant to the marketing that your organisation is involved 
in? 

X Yes 

[| No 
Q7 If no what additional areas would you like to see covered? 
Q8 Isit easy to find information in our existing direct marketing 


guidance? 
[L] yes 


x No 
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Q9 If no, do you have any suggestions on how we should 
structure the direct marketing code? 


No. A general comment on ICO guidance, reported by our 
members, is that it has so much information it is hard for general 
website visitors to isolate and understand the exact guidance they 
need. This is also because the nature of data protection often 
requires businesses to exercise discretion and determine what is 
reasonable behaviour in the context of their operations. 

We and our members have found the direct marketing checklist 
very useful, so we suggest that this is published in an updated 
format. 


© 

ICO. 

Q10 Please provide details of any case studies or marketing aa 
scenarios that you would like to see included in the direct 


marketing code. 


Our members are recruitment businesses. Fundamental to their 
businesses is the maintenance of up to date databases of 
candidates and client contacts and use of online resources such 
as jobboards and LinkedIn. 

A recruitment business needs to stay in touch with candidates and 
clients, to ensure their databases are up to date and to become 
aware of candidates searching and roles needing to be filled. This 
is not considered direct marketing in the industry, rather business 
activity and we advise our members to ensure that such contact is 
relevant, appropriate in frequency and volume. 

It would be helpful to understand the ICO’s approach to industries 
such as recruitment and we would welcome the opportunity to 
discuss further with you. 


Q11 Do you have any other suggestions for the direct marketing 
code? 
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About you 


Are you answering these questions as? 
A public sector worker 

A private sector worker 

A third or voluntary sector worker 

A member of the public 

A representative of a trade association 
A data subject 

An ICO employee 

Other 


a a J 


If you answered ‘other’ please specify: 


İCO. 


Information Conmalssioner’s Office 


Q13 Please provide the name of the organisation that you are 
representing. 


Association of Professional Staffing Companies (Global) Ltd 


Q14 We may want to contact you about some of the points you 
have raised. If you are happy for us to do this please provide 
your email address: 
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Thank you for taking the time to share your views and experience. 
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